Malicious Code Detected in non-modular-buildable Package - Security Alert
Summary
MAL-2025-192346: Malicious code in non-modular-buildable (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'non-modular-buildable' package is an npm library that is typically used in JavaScript projects to manage build processes. It is designed to facilitate the construction of non-modular applications. However, this package has been flagged for containing malicious code, which poses significant security risks to applications relying on it.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the 'non-modular-buildable' package, identified by Amazon Inspector. This code can potentially lead to unauthorized access, data breaches, or other malicious activities within applications that utilize this package. The issue was introduced in version 0 and affects all subsequent versions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall non-modular-buildableIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, consider removing the 'non-modular-buildable' package from your project if it is not essential. You can do this by running: npm uninstall non-modular-buildable. Additionally, you may explore alternative packages that provide similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the 'non-modular-buildable' package highlights the importance of vigilance in managing open-source dependencies. It is essential to stay informed about vulnerabilities and take proactive measures to secure your applications.
See every vulnerability recorded for non-modular-buildable →
FAQ
It is an npm package used for managing build processes in JavaScript applications, specifically for non-modular builds.
You can use tools like Vulert, which monitors your package-lock.json file for vulnerabilities. Visit Vulert Scanner to check your application without signing up.
Using such a package can lead to data breaches, unauthorized access, and potential compromise of your application and its users.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and stay updated on security advisories related to your packages.
Consider removing the package if it is not critical to your application, or look for alternative packages that provide similar functionality.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
